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PURPOSE 


Clause  No.  2  of  Contract  No.  DAMj-177-TC-715  requires  the  preparation  and 
submission  of  a  reliability  and  failure  analyses  report  for  the  XV-5A 
Flight  Research  Vehicle. 

This  report  presents  in  three  parts  the  results  of  reliability  programs 
of  both  the  propulsion  and  aircraft  systems.  Part  I  describes  the  objectives, 
plans,  and  results  of  the  overall  XV-5A  Reliability  Program.  Part  II  covers 
the  propulsion  system  reliability  program  for  Task  I,  Design  &  Engineering 
and  Task  II,  Manufacture  &  Flight  Worthiness  Test.  Part  III  covered  the  air¬ 
craft  program  for  the  early  part  of  Task  I,  Design  &  Engineering. 

Prior  to  beginning  Task  IV,  Flight  Test  Program,  a  second  report  covering 
predicted  quantitative  XV-5A  aircraft  reliability  will  be  submitted  as  part 
of  the  XV-5A  Flight  Worthiness  Report. 
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XV-5A  RELIABILITY  PROGRAM 


A.  SUMMARY 

1.  A  roe  an  time  between  catastrophic  failures  of  6700  hours  has  been 

established  as  an  objective  for  the  XV-5A  system  to  provide  a 

5 

chance  catastrophic  failure  probability  of  1  per  10  fan  powered 
takeoff  and  landing  sequences. 

2.  No  prediction  of  XV-5A  reliability  has  been  made;  airframe  designs 
and  reliability  analyses  are  incomplete. 

3.  Propulsion  system  reliability  has  been  predicted  from  component 
design  analyses.  Results  for  the  critical  failure  modes  are 
tabulated  in  Tables  1  &  3* 

4.  A  mathematical  model  of  XV-5A  reliability  has  been  programmed  for 
digital  computation.  This  will  permit  rapid  failure  analyses  and 
reliability  predictions  as  component  inputs  become  available. 

5.  Among  design  changes  made  to  improve  reliability  are  the  adoption  of 
a  dual  tandem  hydraulic  system,  mechanically  coupled  diverter  valves, 
positive  overspeed  protection  for  all  fans,  and  use  of  warning  instru¬ 
mentation  including  fan  unbalance,  fan  and  aircraft  structural  heating, 
and  excessive  fan  rpm. 
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B.  INTRODUCTION 

1.  Background 

The  scope  and  objectives  for  the  XV-5A  reliability  program  were 
mutually  established  by  the  General  Electric  and  Ryan  Companies 
and  are  as  follows: 

2.  Scope 

The  XV-5A  research  program  is  limited  to  two  aircraft  and  a  fifty 
hour  flight  test  program.  It  is  therefore  impractical  to  conduct 
a  complete  reliability  program  wherein  thousands  of  hours  of  com¬ 
ponent  sub -system,  and  system  teats  and  design  improvements  are 
accumulated.  Scope  of  the  XV-5A  reliability  effort  covers  Design, 
Reliability  Analysis,  System  Testing,  Reliability  Prediction  and 
Measurement. 

The  ultimate  responsibility  for  achieving  reliable  components  rests 
with  the  individual  designers  who  must  obtain  adequate  safety  margins. 
Reliability  analysis  includes  determining  the  required  reliability 
of  a  system,  identifying  the  critical  components  of  a  system  and  their 
significant  methods  of  failure,  determining  the  probability  of  failure 
and  the  need  for  redesign,  re-rating  or  redundancy.  Testing  includes 
a  very  limited  amount  of  component  tests;  major  emphasis  is  on  system 
testing  to  substantiate  design  analyses  and  to  determine  incompatibilities 
of  components  with  each  other  or  with  operating  techniques.  Reliability 
prediction  is  the  mathematical  summation  of  the  various  component  and 
system  analyses  in  terms  that  permit  prediction  of  success  or  failure 
for  discrete  periods  of  operating  time.  Measurement  is  simply  the 
bookkeeping  of  simulator  and  flight  test  experience  and  is  the  proof 
check  of  all  other  reliability  work. 
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B.  3«  Objectives 

A  quantitative  reliability  objective  was  established  early  in  the 
XV-5A  program.  Although  research  or  prototype  aircraft  experience 
Indicates  a  high  probability  of  catastrophic  failure ,  the  XV-5A 
objective  was  set  two  to  three  orders  in  magnitude  better.  The 
objective  probability  of  catastrophic  failure  is  1  per  10^  take-off 
and  landing  sequences. 

In  establishing  objectives,  MIL-R-275^2  (Reliability  Program  Require¬ 
ments  For  Aerospace  Systems,  Subsystems  and  Equipment)  was  reviewed. 
Certain  applicable  portions  of  the  specification's  requirements  were 
adopted  as  guiding  principles  of  the  XV-5A  reliability  program.  These 
are  repeated  below? 

*  The  reliability  program  shall  recognize  the  concept  of  inherent 
reliability  of  design,  i.e.,  the  inherent  reliability  is  established 
by  the  basic  design  and  can  be  improved  only  by  design  changes. 

*  Improvement  of  reliability  is  best  achieved  in  the  early  phases 
of  development  and  the  testing  program. 

*  A  factor  in  system  reliability  is  human  reliability  which 
Includes  the  extent  to  which  the  equipment  has  been  engineered 
to  minimize  human  error  in  the  manufacture ,  test,  operation,  and 
maintenance  of  the  system. 

*  Reliability  must  be  a  major  factor  in  planning,  management  and 
engineering . 
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C.  DISCUSSION 

1.  Reliability  Defined 

As  used  in  the  XV-5A  program,  reliability  means  the  probability  that 
the  aircrait  performs  its  required  function  under  the  anticipated 
flight  conditions  without  failure  for  a  specified  period  of  time. 

2.  Emphasis  on  Take-Off  &  Landing  Sequence 

As  stated  in  the  objectives,  the  purpose  of  this  program  is  to  achieve 
a  specific  level  of  basic  flight  safety  during  the  critical  portion 
of  XV-5A  flight,  i.e.,  fan-powered  take-off  and  landing.  If  that 
objective  can  be  achieved,  then  the  reliability  of  the  research 
"missions”  and  conventional  flight  in  general  vlll  be  more  than 
adequate.  The  reasoning  is  as  follows:  The  propulsion  system  and 
aircraft  systems  are  the  most  complicated  in  fan-powered  mode.  Many 
potential  failures  are  critical  only  in  the  fan  mode.  In  take-off, 
for  example,  once  the  fan  mode  operation  ends  with  conversion  to  con¬ 
ventional  flight,  the  propulsion  system  and  aircraft  systems  are  sig¬ 
nificantly  reduced  in  complexity  to  the  point  where  reliability  is 
determined  primarily  by  the  aircraft  structure,  conventional  controls, 
and  turbojet  propulsion. 

3.  Catastrophic  Failure 

The  type  of  failure  described  in  the  objectives  refers  to  catastrophic 
events  such  as: 

*  Pilot  fatality  or  serious  injury  due  to  design  deficiency  or 
malfunction . 

*  Total  loss  of  an  aircraft  due  to  fire  or  other  malfunction  resulting 
in  pilot  ejection. 

*  Irreparable  damage  due  to  malfunction. 


1-4 


X7-5A  RELIABILITY  PROGRAM 


r- 


C.  3*  Basic  causes  of  catastrophic  failure  are  as  follows: 

a .  Pilot  error 

b.  Aircraft  structural  failure 

c.  Aircraft  control  system  failure  including  hydraulic  and  electrics,' 

d.  Propulsion  system  destructive  mechanical  failure 

e .  Uncontrollable  fire 

Pilot  error  is  controllable  in  design  by  the  extent  of  authority 
available  to  make  mistakes.  The  quantity  of  simultaneous  or 
sequential  pilot  functions  determines  error  probability  more  than 
the  choice  of  pilots.  The  four  remaining  major  causes  of  catastrophic 
events  are  essentially  independent  of  each  other.  Therefore  reliability, 
R^,,  of  the  XV-5A  is  Rb  x  Rc  x  Rd  x  Re.  Conversely,  the  unreli¬ 
ability  is  approximately  the  sum  of  failure  probabilities  -  Qb  + 

Qc  +  Qd  +  Qe.  Therefore,  to  achieve  a  catastrophic  failure  prob¬ 
ability  no  worse  than  1  per  10^  take-off  and  landing  sequences,  each 
of  the  four  major  system  including  the  poorest  should  have  catastrophic 
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failure  probabilities  better  than  1  per  10  take-off  and  landing  sequence. 

4.  Mean  Time  Between  Failure  Required 

Assuming  that  the  minimum  practical  duration  of  a  fan -powered  take-off 
and  landing  sequence  is  four  minutes,  the  minimum  mean  time  between 
catastrophic  failures  can  be  approximated: 

Qrp  =  .00001  or  R^,  =  .99999  for  4  minute  period 

T. 

R  =  e  m  where  m  =  MTBF  and  T  =  the  time  interval  involved. 
Rj  "  (  1  -  ^  tfhere  ^  «■! 

M  '  =  TSSoof3''  ■  6700  hours 
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C.  4.  Thus  aggregate  mean  time  between  catastrophic  failures  of  the  XV-5A 

should  be  not  less  than  6700  hours.  Since  the  failure  rate,  X  =  - 

m 


-4 

=  1  =  1.5  x  10  failures  per  hour. 

1  S700 

As  previously  described,  the  XV-5A  contains  four  major  systems  - 
each  with  its  attendant  X 


xcT  XdT  XeT 

Therefore  R_=e  xe  >.  e  xe 


=  e 


f(^b  +  Xc  +  Xd  +  X ej 


If  arbitrarily 

Xfc  Xc  Xd  Xe 

then,  for  example,  the  propulsion  system  failure  rate, 

-4  -5 

^  ~  1 . 5  x  10  =  3.75  x  10  failures  per  hour. 


It  should  be  remembered  that  these  failure  rates  are  the  chance  un¬ 
reliabilities  which  would  produce  catastrophy  -  not  just  a  mission 
abort,  reduced  performance ,  or  nuisance. 


5.  Further  Breakdown  of  Aircraft  Systems 

In  Part  III  of  this  report,  the  XV-5A  is  shown  as  further  divided 
into  ten  systems.  These  are  the  significant  separate  systems  which 
are  then  sub-divided  further,  down  to  the  component  level.  A  digital 
computer  program  has  been  developed  as  a  mathematical  model  of  XV-5A 
reliability  to  aid  in  evaluating  effects  of  component  and  system  reli¬ 
ability  changes  and  to  determine  component  reliabilities  required  to 
provide  a  given  system  or  aircraft  reliability. 

At  this  writing,  there  is  insufficient  component  data  to  predict  an 
overall  XV-5A  reliability  or  catastrophic  failure  rate;  this  will  come 
as  designs  are  completed. 
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C.  6.  Propulsion  System  Reliability 

The  propulsion  system  including  engines,  fans,  and  diverter  valve3 
has  been  evaluated  from  two  approaches:  test  experience  and  reli¬ 
ability  analyses  of  component  designs.  Except  for  the  J-85  turbojet 
engine,  test  experience  is  too  limited  to  use  as  a  measure  of 
catastrophic  chance  failure  rate.  Therefore  the  predicted  rates 
were  obtained  from  analyses  of  the  critical  potential  failures 
using  a  common  reliability  evaluation  technique  of  determining  the 
safety  margins  between  strength  and  stress.  The  results  of  these 
analyses  are  discussed  in  Part  II. 

Propulsion  system  reliability  efforts  have  been  after-the-fact  for 
the  most  part.  This  situation  is  due  to  the  fact  that  the  principal 
XT-5A  research  program  objective  is  to  demonstrate  in-flight  an 
existing  X353-5  propulsion  system.  Design  changes  have  been  held  to 
a  minimum;  most  of  these  were  undertaken  to  correct  known  deficiencies 
and  therefore  improve  reliability,  or  to  facilitate  installation  in 
the  airframe. 

In  contrast,  the  airframe  is  an  entirely  new  design;  reliability 
effort  has  therefore  been  concentrated  before-the-fact. 
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A.  SUMMARY 

1.  Fans  &  Diverter  Valve 

A  technique  of  failure  rate  prediction  described  in  Ref.  2,  has 
been  applied  to  critical  components  of  the  fans  and  diverter  valves. 
While  the  method  does  not  provide  exact  probabilities  of  component 
failure,  it  is  the  best  available  approach  to  estimating  such  in¬ 
formation  from  the  combination  of  design  analyses  and  limited  test 
experience.  Results  are  summarized  in  Table  3 >  page  II  18-A. 

2.  J85  Turbojet 

Extensive  factory  and  flight  test  experience  has  provided  failure 
rate  data.  Allowing  for  the  simpler  non-reheat  XV-5A  J85  configura¬ 
tion,  predicted  performance  is  summarized  in  Table  1,  page  II-8. 

3.  Complete  Propulsion  System  Reliability 

Analysis  of  complete  installed  propulsion  system  reliability  is  in¬ 
complete  at  this  writing  and  requires  further  work.  Early  results 
are  discussed  in  Part  III. 

4 .  Chance  Failure  -  vs  -  Wearout  Failures 

The  predicted  probabilities  of  chance  or  random  failures  should 
not  be  confused  with  wearout  failures.  Component  deterioration 
due  to  erosion,  for  example,  must  be  continuously  monitored  by  a 
vigorous  routine  of  post-flight  and  periodic  inspections.  These 
routines  will  be  defined  in  the  maintenance  and  operating  instructions. 
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B.  INTRODUCTION 

1.  Description  of  Propulsion  System 

The  propulsion  system  described  in  this  part  of  the  report  includes 
these  components: 

*  2  J-85-GE5  turbojet  engines  with  controls  and  accessories  but 
modified  for  dry  operation  only. 

*  2  diverter  valves  including  mechanical  coupling  linkage  mechanisms, 
and  hydraulic  actuator  but  not  the  hydraulic  controls. 

*  2  X353-5B  lift  ferns  including  mounts  and  exit  louvers. 

*  1  X376  pitch  fan 

2.  Operating  Requirements 

in  operational  use,  the  propulsion  system  will  be  converted  between 
the  fan -power  mode  and  turbojet  power  mode  during  each  vertices, 
take-off  and  landing.  Certain  sequences  and  precautions  must  be 
maintained  during  conversions  to  assure  safe  flight.  These  are 
described  below. 

Fan  power-to-turbo jet  power  conversion  -  The  first  action 
responding  to  pilot  command  must  be  the  switching  of  diverter 
valves  to  remove  gas  power  from  the  fans.  This  produces  an 
immediate  buildup  of  turbojet  thrust  and  allows  the  three  fans 
to  coast  down  toward  windmilling  rpm.  After  gas  power  is  removed 
from  the  fans,  a  time  interval  of  approximately  two  seconds  must 
be  allowed  before  fan  inlets  may  be  closed-off.  The  interval  pro¬ 
vides  a  rundown  to  approximately  40$  rpm  at  which  time  the  inlets 
may  be  closed-ofi'  by  the  wing  fan  cover  doors  and  the  nose  fan 
inlet  louvers. 

As  soon  as  inlets  are  closed-off,  the  exit  variable  geometry  may 
be  closed  to  complete  the  propulsion  system  conversion  sequence. 
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B.  2.  Turbojet  power  to  fan  power  conversion  -  The  action  of  variable 
geometry  in  this  sequence  is  essentially  the  reverse  of  the  pro¬ 
cedure  described  previously.  Initial  action  responding  to  pilot's 
conversion  command  must  be  the  opening  of  all  fan  inlet  and  exit 
geometry.  Only  after  the  inlets  and  exits  attain  open  positions 
can  diverter  valves  be  switched  to  deliver  gas  power  to  the  fans. 

Part  III  of  this  report  describes  a  conversion  interlock  system 
which,  among  other  functions,  positively  assures  the  proper  se¬ 
quence  of  conversion  variable  geometry  in  response  to  a  single 
pilot  operated  mode  selector. 

Fan  overspeed  tendency  -  Four  external  factors  affect  X353-5B 
fan  rpm  at  constant  throttle  setting. 

*  Turbojet  ram  recovery  -  increased  gas  power  with  forward 

flight  speed. 

*  Fan  crossflow  effect  -  unloading  at  increased  flight  speed. 

*  Exit  louver  throttling  -  unloading  with  reduced  discharge 

area  from  vectoring  or  staggering  louvers. 

*  Fan  inlet  stall  -  unloading  at  full  wing  stall. 

Tests  have  shown  the  first  three  causes  of  increased  rpm  to  be  con¬ 
tinuous  functions  and  therefore  predictable  and  controllable  by  the 
pilot.  For  this  reason,  the  fan  tachometers  include  a  sensor  and 
indicator  to  visually  warn  the  pilot  of  high  rpm  operation.  The 
wing  stall  causes  a  10#  rpm  discontinuity.  Because  the  resultant 
rpm  can  quickly  exceed  continuous  operating  limits,  an  automatic 
partial  power  cut -back  has  been  incorporated  into  the  J85  control 
mechanism.  Authority  to  restore  full  power  or  override  the  power 
cut  is  provided  to  the  pilot. 
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B.  3»  Fans  As  Control  Devices 

At  flight  speeds  where  conventional  surface  controls  are  ineffective 
the  three  fans  provide  maneuver  and  trim  moments  for  control  of  air¬ 
craft  attitude.  These  functions  along  with  longitudinal  and  verti¬ 
cal  acceleration  of  the  aircraft  are  obtained  from  combinations  of 
fan  thrust  spoiling  and  vectoring.  The  controlling  devices  are 
located  in  exhaust  streams  of  the  three  fans.  Reliability  aspects 
of  fan  exit  louvers  mechanisms  are  covered  in  this  section  of  the 
report.  Part  III  includes  X376  fan  exit  geometry  and  control  of 
all  fan  variable  geometry. 
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C.  DISCUSSION 

1.  Fern  Teat  Experience 

At  this  writing,  X353-5  fans  have  accumulated,  over  400  hours  of 
operating  experience  in  both  static  and  wind  tunnel  tests.  X376 
fans  have  accumulated  over  75  hours  of  static  operation.  Although 
X353-5  fans  have  sustained  several  occurrences  of  minor  damage  and 
one  instance  of  significant  damage,  1  no  failures  have  occurred 
which  would  have  caused  catastrophic  consequences  in  XV-5A  flight. 

2 .  Fan  Reliability  From  Test  Experience 

An  attempt  to  apply  a  statistical  evaluation  technique  to  the 
available  test  experience  proved  to  be  meaningless  due  to  the 
relatively  small  accumulated  time  as  compared  with  objectives  for 
mean  time  between  catastrophic  failure  discussed  in  Part  I.  The 
results  are  included  only  to  show  that  probably  never  during  the 
XV-5A  research  program  will  experience  be  sufficient  to  permit 
meaningful  statistical  evaluation  of  reliability. 

The  procedure  used  was  obtained  from  Reference  3.  It  provides 
probable  range  of  MTBF  for  a  chosen  confidence  level  based  on 
total  test  time  and  the  number  of  failures  occurring  within  that 
time. 

First  use  only  that  test  time  at  greater  than  75#  rpm  as  being 
significant  in  XV-5A  operation. 

T^  =  4 00  *  hours 

TN  >  75*  =  70  h0urs  ‘  T 

XRefer  to  Reference  2  for  discussion  of  Flight  Worthiness  Test  results. 
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C.  2.  Let  total  number  of  failures,  N  =  actual  number  +  1 
N  =  0  +  1  =  1 


then  |  =  12  =  70 


T 


From  Reference  2  table  of  probability  for  -  =  70,  for  QOf? 


confidence, 

find  £  =  2.33  &  |  .  =0.1 

N  upper  N  lower 

70 

Then  (MTBF)  upper  =  =  700  hours 


and  (MTBF)  lower  =  jr  —  =  30  hours 

•  JJ 


These  results  say  with  80$  confidence  that  for  70  hours  experience 
without  failure,  the  probable  MTBF  of  similar  components  is  between 
30  and  700-  hours.  Thus  the  futility  of  statistics  is  seen  when  the 
experience  is  limited. 


The  foregoing  discussion  is  not  intended  to  belittle  the  practice 
of  development  and  qualification  testing.  Later  in  this  section  it 
will  be  shown  that  the  measurement  of  performance  and  design 
parameters  for  substantiation  or  modification  is  a  requirement  in 
the  analytical  determination  of  reliability. 


3.  J85  Test  Experience 

Extensive  J85  test  experience  is  available  from  thousands  of  hours 
of  factory  tests,  flight  tests,  and  operational  use  in  T  38  aircraft. 
Although  this  experience  is  based  on  a  rebeat-configured  j85-5> 
simple  bookkeeping  provided  the  dry  engine  reliability  data  needed. 
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C.  3*  J85  failure  significance  -  The  type  of  failures  investigated 

included  total  and  partial  power  loss.  Consequence  of  these 
failures  in  conventional  turbojet  mode  XV-5A  flight  is  not 
catastrophic  since  single  engine  performance  is  adequate.  Con¬ 
sequence  of  power  failure  in  fan-powered  mode  depends  upon  the 
flight  condition.  The  engine -out  recovery  curve  in  Reference  b 
illustrates  this  point.  At  XV-5A  design  gross  weight  (9200 #) 
and  hot  day  conditions ,  the  maximum  hover  lift  /  weight  ratio  of 
1.15  decreases  to  O.69  in  event  of  a  single  J85  total  power  loss. 
Above  a  few  feet  altitude,  there  is  an  envelope  of  altitude  -  vs  - 
flight  speed  in  which  recovery  cannot  be  effected  by  either  of  the 
following  engine -out  procedures: 

a)  Pitch  over  and  accelerate  during  descent  until  wing 
lift  plus  .69  (G.W. )  fan  lift  is  sufficient  to  effect 
a  flare  of  6  ft. /sec.  or  less  sink  rate  at  touchdown 
followed  by  a  short  roll-out. 

b)  Pitch  over  and  vector  fans  for  accelerating  thrust  until 
sufficient  altitude  is  traded  for  acceleration  to  a 
flight  speed  at  which  conversion  to  single  engine  wing- 
supported  flight  can  be  made. 

Further  studies  of  J85  failure  probabilities  have  been  performed 
with  results  shown  in  Table  1. 

J85  reliability  diagram  -  Figure  1  shows  the  serial 
arrangement  of  basic  J85  components.  Also  shown  is  the  power 
take  off  for  aircraft  accessories . 
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C.  3-  Predicted  J85  MTBF  -  Table  1  below  summarizes  the  random 
or  chance  failures  expected. 


TABUS  1 

J85  Reliability 

Type  of  Failure 

MTBF 

a. 

Unscheduled  maintenance 
premature  removal 

or 

100  hours 

b. 

90$  <  Power  available 

0 

0 

V 

129 

0 

75$  <r  Power  available 

0 

ON 

V 

165 

d. 

Zero  Power  available 

1000 

e. 

Internal  destruction 

2235 

4.  Fan  Overspeed  Control  Reliability 

In  Paragraph  II  B  2  of  this  report,  the  causes  and  prevention  of 
fan  overspeed  operation  were  described.  Use  of  protective  devices 
generally  introduces  additional  failure  mechanisms  to  a  system. 

The  power  cutback  device  is  no  exception.  However,  careful  design, 
restricted  power  authority,  and  limited  range  of  operation  have 
been  exploited  to  minimize  consequences  of  overspeed  protection 
failures . 

Authority  of  the  overspeed  limiter  has  been  restricted  to  30$  of 
J65  power;  i.e.,  it  cannot  reduce  power  below  70$  of  maximum  which 
corresponds  to  95$  J85  rpm.  The  power  authority  is  equivalent  to 
roughly  10$  fan  rpm  or  20$  lift.  Therefore  an  unnecessary  power 
cutback  would  reduce  lift  to  80$  of  maximum.  The  pilot  has  authority 

1 

to  restore  full  power  by  use  of  a  thumb  switch  in  the  collective  lift 
control  stick.  Pull  power  can  be  restored  In  just  under  one  second. 
Since  fan  overspeed  is  improbable  at  hover  or  low  speed  and  since 
the  consequence  of  unjustified  power  cut  at  these  concutions  is 
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C.  4.  critical,  the  power  cutback  function  is  dis-armed  at  exit  louver 

angles  less  than  20  degrees.  It  is  armed  between  20  and  50  degrees 
which  corresponds  to  the  high  transition  speed  range  where  the  over¬ 
speed  is  likely  to  occur.  Beyond  50  degrees,  it  is  again  disarmed 
so  that  inadvertant  power  cuts  will  not  occur  in  conventional  turbo¬ 
jet -powered  flight. 

In  addition,  the  overspeed  system  is  designed  for  random  MTBF  as 
shown  in  Table  2. 

TABIE  2 

Fan  Overspeed  Control  Reliability 


Failure  Mode  MTBF 

a.  Power  cut  ut  less  than  cut-in  rpm  10  hours 

b.  No  power  cut  at  cut-in  rpm  or  greater  10  hours 

c.  Loss  of  rpm  indication  in  cockpit  10  hours 

d.  Loss  of  high  rpm  warning  function  10  hours 


5*  Design  Analysis  of  Fan  and  Diverter  Valve  Reliability 

Summary  of  analytical  technique  -  Reference  3  defines  a 
design  procedure  which  provides  estimates  of  chance  failure 
probabilities  for  mechanical  components.  The  technique  can  be 
summarized  as  follows: 

a)  Determine  the  important  loading  conditions  in  fan- 
powered  XV-5A  flight  in  terms  defining  mechanical 
design  parameters. 

b)  Delineate  those  critical  components  of  each  assembly 
whose  failure  can  cause  significant  consequences  in 
XV-5A  flight. 
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C.  5. 


c)  Define  the  component  failure  mechanisms ;  e.g.,  stress 
rupture,  fatigue,  deflection,  yield,  etc. 

d)  Using  the  designers'  calculated  or  measured  stresses, 
define  normal  distributions  of  stress  variation. 

e)  Using  average  material  property  data  define  probable 
normal  distributions  of  strength  variation. 

f)  From  statistical  mathematics,  calculate  the  probabilities 
of  events  in  which  stress  exceeds  strength. 

g)  A  summation  of  these  event  frequencies  then  yields  the 
chance  failure  rate  of  the  assembly. 


Loading  conditions  -  Three  major  factors  determine  stresses 
in  propulsion  system  components.  These  are:  (l)  power  level 
setting,  (2)  aircraft  forward  flight  speed,  and  (3)  precession 
velocity.  Transient  power  changes,  aircraft  angle  of  attack, 
landings,  and  other  factors  also  affect  loading  but  to  a  lesser 
extent  than  those  above.  Drawing  from  the  X353-5B  Propulsion 

i 

System  Specification,  four  XV-5A  flight  conditions  were  used  to 
define  loads: 

a)  Hover  at  maximum  power  and  essentially  zero  precession 
velocity 

b)  Hover  at  maximum  power  and  0.8  radian  /  second  precession 
velocity. 

c)  Maximum  fan  powered  flight  speed  and  essentially  zero 
precession  velocity. 

d)  Maximum  fan  powered  flight  speed  and  0.8  radian  /  second 
precession  velocity. 


These  four  conditions  were  established  an  estimate  of  maximum 
power  operation  at  hover  and  conversion  speed,  with  and  without 
stability  augmentation. 
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C.  5*  Critical  components  -  reliability  diagram  -  In  each 

propulsion  system  component,  there  are  many  critical  components. 

In  the  example  which  follows,  i.e.  an  X353-5  lift  fan,  the  critical 
components  defined  are  those  which  can  produce  catastrophic  con¬ 
sequences  in  event  of  failure.  These  components  are  shown  in  their 
proper  relation  by  Figure  2.  Obviously  test  experience  influences 
the  definition  of  critical  components.  Some  of  the  more  signifi¬ 
cant  test  experience  includes: 

*  measurement  of  rotating  and  stationary  part  stresses 

*  measurement  of  relative  rotor  -  stator  deflection  during 
precession 

*  proof  of  redundancy  in  torque  transmission  system 

*  identification  of  wear  tendencies 

*  demonstrating  non-catastrophic  consequences  of  turbine 
airfoil  mechanical  damage  frpm  upstream  objects. 

Component  failure  mechanisms  -  Each  component  has  several 
mechanisms  of  failure.  Typical  examples  are  yield,  deflection, 
fatigue,  and  rupture.  Not  all  failure  mechanisms  are  significant 
in  any  one  component.  Usually  one  mechanism  becomes  the  con¬ 
trolling  factpr  in  a  particular  component  design.  Variation  in 
load  condition  can  shift  the  relative  significance  of  the  several 
failure  mechanisms.  Thus  for  each  load  condition  a  component 
must  be  analyzed  for  failure  rate  of  each  significant  failure 
mechanism  to  provide  a  total  failure  rate  for  that  component. 

Stress  deviation  -  The  process  of  estimating  a  standard 
deviation  of  stress  involves  review  of  the  designers '  procedure 
to  place  values  upon  the  variables  affecting  the  design. 

Typical  of  these  variables  are  the  uncertainty  of  environment 
and  stress  analysis  method,  whether  or  not  substantiating  tests 
have  been  made,  variation  in  weight  manufacturing  tolerances  or 
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C.  5.  deviations,  corrosion  possibility  and  effect,  practicality  of 
inspection  and  effects  of  stalls  and  other  transients .  These 
factors  then  determine  the  estimated  distribution  of  stress 
around  the  mean  calculated  or  measured  stress;  assuming  normal 
distribution,  a  standard  deviation  can  be  calculated. 

Strength  deviation  -  Two  methods  of  obtaining  a  standard 
deviation  of  strength  are  available.  In  the  first  case  strength 
data  for  some  materials  have  been  statistically  evaluated  in 
terras  of  mean  strength  and  standard  deviations  of  strength  by 
the  Large  Jet  Engine  Department  Materials  Operation.  In  the 
second  case,  strength  data  also  obtained  from  the  Materials 
Operation,  is  presented  as  average  strength  multiplied  by  a 
deviation  factor.  The  value  of  the  expression  (  1  -  dev.  factor) 
is  estimated  as  three  standard  deviations  of  strength  based  on 
materials  evaluation  experience.  Both  methods  of  defining 
material  strength  are  described  further  in  Appendix  1. 

Probability  of  stress  exceeding  strength  -  Figure  3 
graphically  illustrates  the  relationship  between  mean  stress  and 
mean  strength  and  the  distributions  of  these  parameters.  The 
shaded  area  of  overlap  between  distributions  represents  failure 
or  stress  •>  strength.  Failure  rate  is  then  determined  by  cal¬ 
culating  the  relative  area  of  overlap.  The  statistical  mechanics 
will  be  illustrated  in  a  sample  calculation. 

First  example  of  analysis  -  The  fan  rotor  disc  is  used  as 
an  example  in  this  procedure .  Design  data  for  this  component 
were  obtained  from  Reference  2.  First  the  disc  is  analyzed  at 
the  steady  hover  flight  condition: 

#N  =  103^  (2719  rpm) 

W  =0  radians  /  second 

Vp  =  0 
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FIGURE  3 


STRESS  &  STRENGTH  DISTRIBUTION 
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C.  5.  Design  data  shows  a  steady  centrifugal  stress  to  be  63  Ksi 
maximum  at  105$  N  and  W  =  0  =  Vp. 

Scaling  to  103$  rp®‘- 

Max  stress  =  63  Ksi  =  60.6  Ksi 

Max  temperature  =  300®F 

Assuming  the  .2$  yield  strength  approximates  the  stress  at 
which  serious  rotor  -  stator  interference  could  result,  solve 
for  the  probability  of  stress  >  strength. 

From  material  data,  .2$  yield  =  135  Ksi 


Estimate  standard  deviation  of  stress, 


as  tress  = 


f  variations 


2 


Steady  stress  variation 

Load  *  Weight  supported 

*  Transient  overspeed 

*  Acceleration  torque 

*  Impact-brg.  free -play 
Mfg  *  Dimensional  tolerance 

*  Corrosion 

*  Forging  fault 

*  Nicks  and  dents  sensitivity 


3  a  variation 

6$ 

10 

6 

10 

6 

5 

10 

10 


1  q  variation 

2$ 

3 

2 

3 

2 

2 

3 

3 


$  ("  stress)  rms 

-  */(2)2  +  (3)2  +  (2)2  +  (3)2  +  (2)2  +  (2)2  +  (3)2  +  (3)2 
=  V52  =  7.2$ 
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C.  5*  and  astress  =  7*2$  (h  stress) 

=  .072  (60.6  Ksi)  =  U360  psi 

From  material  data,  3astrength  =  15$  (u  strength) 

or,  n  strength  =  5$  strength) 

=  .05  (135  Ksi)  =  6750  psi 

Since  extensive  tests  have  shown  fan  huh  area  temperatures  to 
be  less  than  300#F  plus  the  fact  that  the  XV-5A  cockpit  will 
readout  bearing  temperatures,  assume  that  a  strength  due  to 
a  temperature  is  zero. 

Now  in  effect  we  subtract  the  distribution  of  stress  from  the 
distribution  of  strength  which  yields  a  normal  distribution  of 
the  population  of  differences  as  shown  in  Figure  4. 

Then  =  ~\J  (a  stress)^  +  (a  strength)2 

V  (*+36o)2  +  (6750  f 

=  8000  psi 

and  u  strength  -  u  stress  =  tad 

or  t  =  ^-3^.  psi^  =  9*3  standard  deviations. 

From  a  table  of  normal  distribution  area  versus  standard  deviations 
removed  from  the  mean,  the  probability  or  failure  rate  of  the  disc 
yield  failure  mechanism  is  ^l/lO^.  The  rupture  failure  mechanism 
is  even  lower  in  rate.  For  a  system  with  the  simplicity  of  the 
X353-5,  failure  rates  of  l/lO10  can  be  neglected,  i.e.  assumed  to 
be  zero. 
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FIGURE  4 

STRENGTH  -  MINUS  -  STRESS  DISTRIBUTION 

A 


Area  of  Stress  >  Strength 


t  =  number  of  standard  deviations  from 
mean  difference,  Ud 

CTd  *  standard  deviation  of  the  popu¬ 
lation  of  differences  (strength  - 
stress) 
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C.  5*  The  above  calculations  sinrply  show  that  the  fan  disc  is  not 
designed  to  the  steady  centrifugal  stress  criteria  of  steady 
hovering  flight.  It  is  of  course  designed  to  the  more  stringent 
requirements  of  maneuver  at  conversionf light  speed  where  fatigue 
and  deflection  become  the  significant  failure  mechanisms. 

Second  example  of  analysis  -  Consider  now  the  fatigue 
mechanism  failure  probability  of  the  same  disc  under  max  power 
operation  at  combined  high  forward  flight  speed  and  0.8  radian  / 
second  precession. 

From  Reference  2  at  120  knots,  105#  N  and  2  rad  /  sec: 

Steady  centrifugal  stress  =  63  Ksi 

Alternating  gyro  stress  =  46.2  Ksi 

Crossflow  alternating  stress  =  4850  psi 

Use  of  0.8  rad  /  sec  as  max  maneuver  rate  amounts  to  a 
de -rating  of  the  fan  for  increased  safety  margins. 

Converting  loads:  >  2 

Max  steady  stress  =  63  f ^ =  60.6  Ksi 

Max  crossflow  alt.  stress  =  4850  psi 

Max  gyro  alt.,  stress  =  46.2  18.5  Ksi 

Design  of  parts  subjected  to  combined  steady  and  alternating  stresses 
involves  use  of  a  design  tool  known  as  a  Goodman  Diagram.  Figure  5 
is  a  typical  Goodman  presentation  of  allowable  alternating  stress  -  vs 
-  steady  stress  for  SAT  4340  alloy  hardened  to  the  condition  used  in 
disc  manufacture.  The  curve  shown  represents  average  material 

Q 

combined  load  strength  for  10°  cycles  of  useful  alternating  stress 

Q 

life;  however,  the  10  cycle  curve  is  essentially  coincident  with  a 
curve  of  unlimited  life. 

Estimated  failure  rate  of  a  part  subjected  to  combined  st;.  esses 
is  obtained  by  an  iterative  process  of  determining  the  amount  of 
standard  deviations  of  mean  combined  stress  from  the  mean  strength 
curve  shown  in  Figure  5* 
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C.  5*  Continuing  the  solution  for  a  revised  curve  to  determine 

amount  of  standard  deviations  from  max.  load  point  shown 
in  Figure  5>  assume  first  that  alternating  stress  is  zero 
and  find  ordinate  intercept  using  procedure  previously 
described: 


lj  strength  =  147  Ksi 

u  steady  stress  =  60.6  Ksi 

Let  t  =  8  standard  deviations  as  first  estimate 

From  3teady  stress  example,  a  stress  =7*2#  11  stress 

From  material  data,  CT  strength  =  l/3  (20$  x  U  strength) 
=  9800  psi 

Estimate  ad  =  65OO  psi  and  iterate: 

u  stress  =  u  strength  -  tad 
=  147  Ksi  -  8(6500) 

=  95  Ksi 

Now  a  stress  =  7*2$  (h  stress) 

=  .072  (95  Ksi)  =  6840  psi 


Iterating  for  ad: 


CTd  =  \ 

-  V 


2  2 
n  stress  +  a  strength 

(6840)2  +  (9800)2 


11,900  psi 


This  does  not  check  assumed  n  d  of  65OO  psi. 

Re-^stimate  ad  =  10,600  psi 

Then  U  stress  =  147  Ksi  -  8(10, 600) 

=  62.2  Ksi 

and  n  stress  =  .072  (62.2)  =  4480  psi 

rd  =  ~\J (4480)2  +  (9800)2 

=  10,780 
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(Steady  Stress  -  Ksi) 

O  Combined  steady  &  crossflow  stress 
A  Combined  steady  &  gyro  load  stress 
0  Combined  steady  and  in  phase  max.  alt. 

stress 
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C.  5.  This  is  a  close  agreement;  therefore,  the  zero  alternating 

stress  intercept  for  ^stress  is  62.2  Ksi  as  shown  plotted 
on  Figure  5* 

Now  solve  for  the  alternating  stress  intercept  assuming  zero 
steady  stress . 

Again  let  t  =  8  standard  deviations 

^strength  =  70  Ksi 

Strength  =  l/3  (20$  x  ^.strength)  =  4700  psi 

^stress  -  7*2$  ^stress 

Let  ^d  =  5200  psi  and  iterate  for  U-stress  at  t  =8; 

^stress  =  70  Ksi  -  8(5200)  =  28.4  Ksi 

^stress  =  .072(28.4)  =  2040  psi 

<*d  =  ^4660)2  +  (2040)2 

=  5095  psi  which  is  below  estimate 

Additional  iteration  yields  Ustress  =  29.2  Ksi  which  is  plotted 
on  Figure  5 

By  inspection  of  Figure  5,  it  is  apparent  that  the  original  estimate 
of  8  standard  deviations  was  too  conservative  since  a  curve 
approximation  between  the  t  =  8  intercepts  does  not  enclose  the 
combined  stress  data  points. 

The  foregoing  procedure  is  repeated  for  reduced  values  of  t  until 
the  curve  approximation  encloses  the  max.  combined  load  data 
point.  Successive  iteration  yields  a  value  of  t  =  5.5  or  a 

probability  frequency  of  events  where  stress  exceeds  strength 

8  A 

for  10  cycle  life  of  1.9  x  10”° 
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C.  5*  Result 8  of  analyses  -  Table  3  summarizes  the  results  of 

component  failure  analyses  such  as  just  described.  Also  in¬ 
cluded  are  the  more  important  non-catstrophic  types  of  failures. 
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Material  Certification  and  Use  of  Material  Property  Design  Data 


1.  Material  Property  Curves 

These  curves  whether  in  terms  of  $  creep,  yield,  stress  rupture,  or 
ultimate  (short  time),  are  based  on  average  test  data  usually  from 
several  specimens  and  several  vendors  (where  possible).  In  terms  of 
reliability,  the  probability  of  failure  from  any  cause,  whether  time 
related  or  not,  is  one  in  two;  therefore  P  =  Q  =0.5 

<2.  Deviation  Factors 

The  material  curves  usually  carry  a  number  with  them  (from  .75  to 
•  95)  called  a  deviation  factor.  The  true  and  only  definition  of  the 
material  deviation  factor  is: 

The  material  curve  stress  values,  be  they  creep,  yield,  rupture, 
etc.  when  multiplied  by  the  deviation  factor  provide  the 
designer  with  values  of  the  minimum  material  strength  which 
will  be  certified  or  accepted  by  the  Material  or  Quality 
Control  functions  of  the  Manufacturing  process. 

Since  the  deviation  factor  forms  a  minimum  level  of  material  acceptance, 
it  causes  a  discontinuity  in  the  normal  distribution  of  material 
strength  (failures)  and  therefore  has  no  co-relation  with  standard 
deviations  from  the  mean  failure  level.  Except  for  the  fact  that 
perfect  homogeneity  does  not  exist  in  a  given  batch  or  run  of  material, 
the  use  of  deviation  factors  and  material  certification  would  provide 
minimum  material  strengths  equivalent  to  an  infinite  number  of  standard 
deviations  from  mean  failure  strength.  Since  materials  are  actually 
not  perfectly  homogenous  e  ,  for  example,  between  a  test  sample  and 
the  remainder  used  for  manufacture,  the  combination  of  deviation 
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2.  factor  and  certification  does  not  assure  the  necessary  standard  de¬ 
viations  from  mean  strength  for  required  reliability  and,  more  im¬ 
portantly,  the  designer  has  no  quantitative  knowledge  of  standard 
deviations  in  his  design. 

No  standard  procedure  exists  for  establishing  a  material  deviation 
factor;  it  is  generally  negotiated  with  vendors  of  the  material  and 
thus  serves  as  an  agreement  as  to  what  G.E.  will  and  will  not  accept 
as  "good"  material.  Factors  influencing  the  actual  value  of  a  deviation 
factor  include  the  complexity  of  an  alloy  -  the  difficulty  in  main¬ 
taining  properties  among  batches,  and  the  number  of  alternate  vendors 
-  lack  of  competition. 

3.  Material  Certification  and  Sampling 

Certification  is,  in  effect,  a  notice  to  the  user  that  a  quantity  of 
material  has  been  tested  and  its  properties  meet  or  exceed  minimum 
requirements  of  a  designated  G.E.  material  specification  as  evidenced 
by  results  of  specified  property  tests. 

a.  Sheet  Stock  -  Sheet  stock  is  rolled  from  ingots.  In  some  cases, 
several  thicknesses  of  the  same  stock  are  rolled  from  a  single 
ingot.  It  is  general  practice  to  certify  the  sheet  material  only 
once  per  ingot  regardless  of  the  number  of  stock  sheets  produced, 
so  long  as  the  sheets  are  the  same  thickness.  Experience  has  shown 
that  a  single  certification  is  justified  by  uniformity  of  the 
properties  of  single-thickness  stock  rolled  from  a  single  ingot. 

For  the  case  in  which  several  stock  thicknesses  are  rolled  from 
a  single  ingot,  certification  is  generally  required  for  each 
different  thickness. 
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3*  b.  Forgings  -  Even  though  the  stock  for,  say  100  identical  forgings 
may  come  from  a  single  billet,  the  forging  process  so  alters 
material  properties  that  single  certification  cannot  be  used  with 
confidence.  Typical  practice  is  to  certify  the  material  of  groups 
of  forgings  vhich  logically  form  during  the  forging  process.  For 
example,  if  units  are  heated  and  forged  in  groups  of  ten  because 
of  equipment  limitations,  a  material  certification  will  be  made  for 
each  group  of  ten.  Where  large  material  flow  takes  place  such 
as  upsetting  for  blade  dovetails,  the  lot  certification  may  include 
samples  of  material  from  more  than  one  area  of  a  single  forging. 

4.  Revised  LJED  Presentation  of  Material  Property  Curves 

New  material  property  curves  issued  through  LJED  Standards  now  include 
standard  deviation  data  for  calculating  the  probability  of  obtaining 
material  with  greater  than  or  less  than  a  specified  strength.  In 
general,  strength  curves  not  associated  with  time  include  a  one 
standard  deviation  plot  of  stress  reduction  -  vs  -  temperature.  Time 
-  temperature  strength  curves  include  a  three  standard  deviation  plot 
of  strength.  In  either  case,  the  number  of  standard  deviations  can 
be  scaled  as  required. 
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Application  of  Materials  Safety  Margins  To  Design  Reliability 

Percent  safety  margin  practices  yield  little  information  as  to  the  theoretical 
safety  designed  into  the  part.  A  part  may  be  X$  of  stress  safe  or  Y  psi  safe 
but  there  is  no  quantitative  analysis  possible  which  says  that  the  part  is 
designed  to  be  1  failure  in  100  safe  or  1  failure  in  1  million  safe.  Using 
the  standard  deviation  information  will  allow  the  design  engineer  to  select 
a  stress  level  which  will  correspond  to  a  stated  sureness  that  P$  of  the 
material  will  be  at  least  that  strong. 

Briefly,  the  standard  deviation  data  can  be  used  to: 

A.  Aim  for  a  designated  degree  of  reliability  in  the  part. 

B.  Compare  the  risk  between  alternate  designs  (i.e.,  the  cost  in  terms 
of  reliability  of  a  weight  saving  or  the  relative  reliability  of  two 
design  approaches  against  a  given  weight  bogey). 

C.  Construct  a  safety  margin  which  is  tailormade  to  the  specific  situation. 

To  do  this,  assign  numbers  of  standard  deviations  to  each  element  of 
the  design  situation,  then  take  the  square  root  of  the  sum  of  the 
squares  to  get  the  overall  factor.  This  method  is  advocated  by 

Lusser  and  other  authorities  in  the  *f»li  .bility  field. 

D.  Appraise  design  approaches  by  comparing  actual  part  failure  history 
against  the  safety  margin  values  initially  used  in  the  design.  If 
approach  C  (above)  is  used,  the  validity  of  the  overall  margin  and  its 
elements  can  be  appraised. 

DETERMINATION  OF  ALLCWABIE  DESIGN  STRESS 

To  determine  the  tolerable  short  time  stress  level  for  the  part: 

1.  Select  "  number  (N)  of  standard  deviations  from  Table  I  which  best 
meets  the  reliability  criteria  for  the  part. 
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2.  Multiply  the  psi  value  for  1  standard  deviation  (for  the  temperature 
under  consideration)  by  the  number  (N)  of  standard  deviations  dete  Tnined 
in  item  1 

3.  Subtract  this  from  the  average  strength  at  the  same  temperature 

To  determine  the  allowable  design  creep,  rupture,  or  relaxation  stress  level 
or  parameter: 

1.  Select  a  number  (N)  ol  standard  deviations  from  Table  I  as  before. 

2.  From  the  data  curve  drawing  determine  the  numberical  value  of  1 
standard  deviation  in  terms  of  stress  (at  a  selected  parameter)  or  in 
terms  of  parameter  (at  a  selected  stress)  by  dividing  the  numerical 
difference  between  the  average  and  3  standard  deviation  lines  by  3* 

3.  Determine  allowable  stress  or  parameter  as  above 

Design  Parameter  =  Avg.  Parameter  -  N  x  Standard  Deviation  (Parameter) 

Design  Stress  =  Avg.  Stress  -  N  x  Standard  Deviation  (psi) 

NOTE:  The  presentation  of  the  3  standard  deviation  line  on  the 
parameter  plot  does  not  infer  that  3  standard  deviations 
should  be  used  in  every  case.  The  3  standard  deviation 
line  was  chosen  because  it  is  far  enough  from  the  average 
to  avoid  confusion  in  reading  the  two  lines. 

The  need  to  determine  easily  either  Design  Parameter  or  Design 
Stress  makes  the  format  used  for  tensile  properties  impractical 
as  a  format  of  the  stress  vs.  parameter  presentation. 
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PRECAUTIONS : 

For  the  most  realistic  results,  it  is  highly  recommended  that  certain 
precautions  be  observed  (otherwise  a  more  conservative  than  necessary 
design  may  result): 

1.  Wh3re  the  environmental  conditions  are  fairly  accurately  known  and 
the  design  calcuations  correlate  well  with  actual  stresses  the  use 
of  "nominal"  design  conditions  (dimensional  tolerances,  temperature 
variations,  etc.)  is  recommended.  This  requires  only  the  comparison 
of  one  stress  to  the  strength  for  a  given  safety  measure,  (a  above). 

2.  Be  sure  the  design  claculations  are  stripped  of  as  many  arbitrary 
multipliers,  additional  "materials  deviations,"  etc.,  as  possible. 

Where  jperating  environment  is  poorly  defined  in  terms  of 
temperature,  loads,  etc;  or  where  accurate  analysis  of  the  stresses 
is  difficult  because  of  design  complexity  or  probable  manufacturing 
variations  (i.e.,  complex  sheet  metal  weldment),  approach  C  above 
should  be  used.  Use  "nominal"  stress  calculations  and  assign  additional 
units  of  the  standard  deviation  to  cover  the  undefinable  variables, 
i.e.,  3  standard  deviation  overall  reliability  target  plus  1  sigma 

for  poorly  defined  environment  plus  2  for  manufacturing  variability. 
Taking  the  square  root  of  the  sum  of  the  squares  given  an  overall 
safety  margin  of  3*75  standard  deviations  to  achieve  the  target  of 
3  standard  deviations. 

3.  More  precision  is  possible  if  the  overall  distribution  (variability) 
of  stresses  with  respect  to  variable  G  loading,  dimensional  tolerances, 
and  other  design  variables  can  be  determined.  A  more  accurate  analysis 
of  the  reliability  or  risk  target  is  then  possible  than  can  be  obtained 
by  using  nominal  stresses.  To  do  this,  the  standard  deviation  of  the 
design  stress  must  be  determined.  The  overall  risk  with  respect  to  a 
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TABIE  1 


N  =  Number  of  Stain dard  Deviations 
P  =  Probability  of  Strength  >  Than 
Q  =  Probability  of  Strength  <  Them 


N 

P 

P  +  Q  =  1.0 

Q 

Q  Fractional 

0 

.500 

•  500 

1  in  2 

1.0 

.8413447 

.15-  3 

1  in  6 

1.5 

.9331928 

.0668072 

1  in  15 

2.0 

.9772499 

.0227501 

1  in  44 

2.5 

.9937903 

.0062097 

1  in  160 

3.0 

.9986501 

.0013499 

1  in  740 

3.5 

.9997674 

.0002326 

1  in  4300 

4.0 

.9999683 

.0000317 

1  in  31,500 

4.5 

.999996602 

.OOOOO3398 

1  in  300,000 

5.0 

.9999997136 

2.864  x  10’^ 

1  in  3,500,000 

5.5 

.999999981 

1.9  x  10‘° 

1  in  500  Million 

6.0 

•999999999014 

9 .86  x  10"10 

1  in  1  Billion 
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3«  given  stress  level  then  becomes  the  product  of  the  probability  of 
a  material  strength  value  that  low  or  lower  (Q  from  Table  I  and 
Figure  l)  times  the  probability  of  a  stress  value  as  high  or  higher 
than  that  under  consideration.  This  is  simply  the  Conditional 
Probability  Law  restated. 

In  the  analysis  of  the  materials  property  data  from  which  the  average 
and  standard  deviation  values  are  derived,  due  consideration  for  the 
effectiveness  of  quality  control  in  rejecting  material  below  the 
specification  minimum  has  been  made.  To  the  best  of  our  knowledge  the 
reliability  or  risk  values  will  be  representative  of  the  true  distri¬ 
bution  of  properties  in  finished  parts  after  all  specification  acceptance 
testing  and  rejections.  Variation  of  properties  caused  by  manufacturing 
procedures  (i.e.,  sheet  metal  fabrication)  after  acceptance  are  not 
included. 
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A.  SUMMARY 

1.  Systems  Analysis 

Hydraulic,  electrical,  auto-stabilization,  and  flight  control 
systems  have  been  continuously  evaluated  for  means  of  improving 
reliability  and  assessing  consequences  of  design  changes.  Several 
component  and  sub-systems  redundancies  and  special  safety  pro¬ 
visions  have  evolved  from  the  quest  for  improved  reliability. 

2.  Propulsion  System 

Initial  efforts  have  produced  failure  probabilities  of  installed 
J85  turbojets.  These  results  are  summarized  in  Figure  8. 

3.  Mathematical  Model 

The  thousands  of  components  comprising  an  XV-5A  have  been  mathe¬ 
matically  related  in  a  digital  IBM  program.  The  program  can  be 
used  to  compute  XV-5A  or  major  sub -system  reliability  for  any 
specific  time  period  and  flight  condition  or  it  can  be  reversed 
to  compute  the  component  reliabilities  needed  to  provide  a 
specific  required  XV-5A  reliability.  The  program  will  be  used 
extensively  as  estimated  component  reliabilities  become  available. 

k.  Test  Plans 

The  most  important  source  of  component  data  will  be  flight  controls 
and  hydraulic  simulator.  Preparation  for  this  test  is  discussed. 
Other  tests  which  will  be  useful  in  reliability  evaluation  are  the 
airframe  static  load  test,  ground  vibration  test,  and  ground  checkout 
tests . 
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B.  PURPOSE 

Part  III  of  this  report  outlines  the  accomplishments  to  date  of  the 
Reliability  and  Failure  Analysis  Program  for  the  U.S.  Army  Model 
XV-5A  Lift  Fan  Flight  Research  Vehicle.  Final  quantitative  predictions 
of  aircraft  flight  saiety  and  mission  reliability  are  not  set  forth  in 
this  report.  These  data  will  be  submitted  as  part  of  the  Flight -Worthiness 
Report. 
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C.  OBJECTIVE 

The  primary  objective  of  the  XV-5A  Airplane  Reliability  Program  is  to 
produce  an  experimental  aircraft  possessing  high  inherent  design 
reliability. 

Given  unlimited  time  and  resources  during  the  operational  checkout 
phase  of  any  experimental  complex  system,  unknown  but  expected  deficiencies 
will  be  detected.  These  deficiencies  can  be  corrected  by  redesign  and 
modification,  but  the  process  is  too  expensive,  time  consuming,  and  in¬ 
efficient  to  be  relied  upon  as  the  sole  means  for  attaining  an  acceptable 
system.  However,  by  application  of  accepted  quantitative  and  qualitative 
reliability  analysis  techniques  during  the  design  phase,  many  of  these 
deficiencies  can  be  identified,  and  either  eliminated  or  modified  to 
bring  the  adverse  effects  of  failures  within  acceptable  limits,  early 
in  the  design  phase  of  development  programs. 

Other  objectives  include  estimation  of  expected  probability  of  detailed 
mission  success,  determination  of  operational  flight  safety  criteria, 
determination  of  functional  and  preflight  checkout  requirements,  and 
determination  of  maintenance  requirements. 

From  every  inherent  weakness  diagnosed  and  rectified  during  the  design 
phase  multiple  benefits  have  accrued.  These  benefits  include  increased 
flight  safety;  reduced  down  time;  reduced  costs  for  changes;  and,  of 
greatest  importance,  a  reduction  of  the  likelihood  that  the  research 
program  objectives  will  be  jeopardized  by  random  failures,  or  subtle 
design  deficiencies. 
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D.  DISCUSSION 

1.  General  Reliability  Mathematical  Model 

For  the  purpose  of  Reliability  Evaluation,  the  aircraft  has.  been 
divided  into  10  major  systems.  Each  of  these  systems  has  been 
assumed  to  be  statistically  independent  of  the  other  systems. 

However,  final  quantitative  analysis  of  the  probability  of  catas¬ 
trophic  failure  of  the  aircraft  or  of  successful  completion  of  a 
given  mission  will  include  factors  resulting  from  systems  inter¬ 
actions  . 

A  general  reliability  mathematical  model  of  the  complete  aircraft 
has  been  developed.  This  model  assumes  components  have  exponential 
failure  density  distributions  with  respect  to  time.  The  model  further 
assumes  that  these  components  will  not  be  used  beyond  their  useful 
life.  In  other  words,  that  they  will  be  removed  from  the  system  and 
discarded  or  repaired  before  wear  out  failures  occur. 

A  series  system  is  defined  as  a  system  made  up  of  a  group  of 
elements  arranged  such  that  if  any  one  element  fails,  the  system 
will  fail.  A  parallel  system  is  defined  as  a  system  made  up  of 
elements  arranged  such  that  all  elements  must  fail  before  the  system 
fails.  Sample  reliability  block  diagrams  and  mathematical  equations 
for  these  types  of  systems  are  shown  in  Figure  6,  where  Q  =  probability 
of  failure,  y  =  part  failure  rate,  t  =  operating  time,  and  e  =  the 
base  of  the  natural  of  Napierian  system  of  logarithms  (2. 718  ...). 


Series  System  Parallel  System 


FIGURE  6 
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1.  Once  the  probability  of  failure  "Q,"  at  a  given  time,  has  been 
calculated  for  either  a  series  or  parallel  system,  a  single 
element  with  equivalent  characteristics  may  be  substituted  for 
that  system.  Figure  7  shows  one  series  system  and  one  series 
parallel  system  and  their  relative  positions  in  the  detailed 
block  diagram  of  the  aircraft. 


The  probability  of  failure  equation  of  the  abbreviated  system, 
as  shown  in  Figure  7  is  as  follows: 


t 


V1- 


[(a  +X  +  X  )+X  4./X  +X  )+(X  +x  +x  +, 

\J  29  20  ••  27;  18  '  Ik  15  16'  '  3  4  6 


1 


-t(X  +x  +X 
30  31  32 


+(>39+\o+'4l+ 


■t(\u+\5+\6+”-X63) 


The  general  solution  of  this  equation  has  been  programmed  for 
execution  by  an  IBM  704  Digital  Computer.  The  data  plotted  in 
Figure  8  are  the  results  of  a  typical  subsystem  computation. 
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D.  2.  Systems  Reliability  Analysis 

Both  quantitative  reliability  analysis,  as  described  above,  and 
qup.litative  effects  of  failure  analysis  have  been  employed  to 
evaluate  and  maximize  the  inherent  reliability  of  the  complete 
aircraft  system.  Many  detailed  reliability  improvements  have 
been  incorporated  as  aircraft  and  subsystem  design  progressed. 

Some  of  the  major  studies  and  results  are  described  in  this  section. 

*  Propulsion  systems 
Throttle  Cut-Back  System 

Reliability  aspects  of  a  single  gas  producer  automatic  throttle 
cut -back  system  were  investigated.  Double  throttle  cut -back 
system  was  retained  to  minimize  time  required  to  regain  100$ 
power  after  cut-back. 

Reaction  Time 

single  unit  5*2  seconds 

double  unit  2.9  seconds 

Minimum  Recovery  EnveL-pt 

Minimum  Recovery  envelope  criteria  is  being  developed  based 
on  the  conclusion  that  the  likelihood  of  simultaneous  engine 

f 

failures  (within  two  minutes  of  each  other)  is  too  low  to 
consider,  but  the  engine  out  procedures  (both  engines  fail 
more  than  two  minutes  apart)  will  be  defined.  (Ref.  Figure  8) 

*  Flight  Controls  Systems 
Ailerons 

Aileron  hydraulic  actuators  were  originally  proposed  as  single 
actuators  having  the  left  and  right  hand  ailerons  powered  from 
the  number  one  and  number  two  hydraulic  systems  respectively, 
to  save  weight  and  still  retain  aileron  function  in  event  of 
single  hydraulic  system  failure.  System  failure  analysis, 
after  incorporation  of  aileron  droop  requirements,  showed 
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Figure  8  Propulsion  Subsystem  Failure  Probabilities 
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D.  2.  Ailerons  (Cont'd) 

uncontrollable  stick  reaction  would  occur  during  VTOL 
transition  flight  if  one  hydraulic  system  failed.  Con¬ 
sequently  tandem  actuators  were  incorporated  in  the 
aileron  system,  resulting  in  full  pilot  control  should  either 
hydraulic  system  fail.  Reduced,  but  still  effective  pilot 
control  is  provided  by  the  aero-dynamic  servo-tabs  should 
both  hydraulic  systems  fail. 

*  Hydraulic  system 

The  preliminary  design  hydraulic  system  was  composed  of  a 
primary  and  secondary  power  source  and  single  actuators  with 
automatic  shuttle  valves  to  shift  to  secondary  power  if  the 
primary  system  failed.  This  system  was  more  reliable  than  a 
single  system,  but  a  single  fluid  leakage  failure  in  any  actuator 
could  cause  loss  of  both  systems.  As  a  result'  of  reliability 
analysis,  all  critical  functions  have  been  redesigned  to  incor¬ 
porate  tandem  actuators,  and  all  shuttle  valves  have  been  removed, 
increasing  the  reliability  of  the  hydraulic  system  approximately 
three  orders  of  magnitude. 

*  Electrical  systems 

Two  single  28  volt  DC  generator  systems  were  evaluated  in  terms 
of  reliability  versus  weight  savings  with  the  following  results: 


Relative 

Chance  of  Flight 

Weight 

System 

Safety  Failure 

Ratio 

Savings 

Original  Dual  System 

1:13^7 

1:00 

— 

Single  Generator  with 

Single  Drive 

1:955 

.71 

32  lb. 

Single  Generator  with 

Dual  Hydraulic  Motor 

1:1280 

•95 

12  lb. 

Drive 

III -7 


XV-5A  AIRPLANE  RELIABILITY  PROGRAM 


D.  2.  *  Electrical  Systems  (Cont'd) 

The  amount  of  weight  saved  was  not  considered  adequate  Justifi¬ 
cation  for  reduced  reliability. 

Further  electrical  system  improvements  include  a  three  bus  28V 

DC  system,  a  two  bus  115V  400  cycle  AC  system,  primary  and 

* 

standby  control  circuits  for  fan  powered  flight  controls  and 
conversion  control  systems.  The  28V  DC  electrical  loads  are 

I 

divided  into  three  categories;  l)  Non-Essential  loads;  2) 
Essential  loads;  and  3)  Emergency  loads,  and  are  fed  from  buses 
identified  accordingly.  Two  independent  generators,  one  on  each 
engine,  provide  power  to  the  three  buses.  In  addition  to  the 
generators,  a  silver-zinc  battery,  sized  to  supply  five  minutes 
power  demand  on  the  emergency  bus,  including  one  conversion  mode 
change,  is  provided.  Generator  fault  detectors  are  provided  such 
that  if  either  generator  should  fail,  the  non-essential  bus  drops 
out  of  the  circuit,  and  if  simultaneously  or  subsequently  the 
second  generator  should  fail,  the  essential  bus  drops  out  of  the 
circuit  and  only  the  emergency  bus  powered  by  the  battery  remains 
operative.  Cockpit  indicators  warn  the  pilot  of  generator 
failures .  The  115V  U00  cycle  AC  loads  are  divided  into  two 
categories:  l)  essential  loads,  and  2)  non-essential  loads. 

As  long  as  both  inverters  function  properly,  both  buses  are 
supplied  power.  If  either  inverter  should  fail,  the  non-essential 

l 

bus  is  dropped  out,  and  the  essential  bus  is  powered  by  the 
remaining  inverter.  Warning  lights  on  the  cockpit  annunciator 
panel  warn  the  pilot  of  inverter  failures. 

*  landing  Gear 

Emergency  actuation.  The  landing  gear  is  normally  extended 
and  retracted  by  one  hydraulic  system.  Since  free  fall,  down 
locking  of  the  gear  is  considered  marginal  due  to  gear  con¬ 
figuration,  a  high  pressure  gas  operated  emergency  system  has 
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D.  2.  *  Landing  Gear  (Cont'd) 

been  incorporated.  The  high  pressure  gas  is  stoz*ed  in  the  main 
landing  gear  struts  and  is  manually  controlled  by  the  pilot  to 
effect  emergency  "conventional  gear  down"  operation. 

*  Auto-stabilization  System 

The  Auto-stabilization  system  is  composed  of  three  basic  sub¬ 
systems:  1)  three  axis  rate  gyros,  2)  amplifiers,  and  3) 
electro-hydraulic  servo  valves,  and  operates  only  during  VTOL 
flight  mode. 

The  rate  gyro  and  amplifier  subsystems  each  have  two  independent 
redundant  systems,  the  primary  system  and  the  standby  system. 

The  servo  valves  are  controlled  by  the  primary  or  standby  systems 
on  manual  command  from  the  pilot.  An  indicator  light  in  the 
cockpit  notifies  the  pilot  of  amplifier  hardover  command  failures 
in  any  axis,  or  all  axes.  The  control  authority  of  the  auto¬ 
stab  system  is  limited  to  25$  of  pilot  control  authority  and 
can  be  overpowered  by  the  pilot.  A  hardover  failure  has  the 
effect  of  an  out  of  trim  condition  and  can  be  eliminated  by 
transfer  to  the  other  system. 

Preliminary  flight  simulator  studies  indicate  that  loss  of  one  of 
the  three  axis  control  loops  is  readily  compensated  for  by  the 
pilot.  Further  investigations  In  this  area  are  planned. 

Independent  redundant  electro -hydraulic  servo  valves  were  investi¬ 
gated  but  proved  to  be  undesirable  since  they  would  degrade  the 
reliability  of  the  dual  input  mechanical  servo  actuators.  Several 
precautions  have  been  taken  to  alleviate  the  effects  of  failure  of 
the  auto-stab  electro-hydraulic  servo  valves. 
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D.  2.  *  Auto-stablllzatlon  system  (Cont’d) 

Each  servo  valve  torque  motor  has  two  colls,  each  capable  of 
functioning  alone.  The  roll/yav  servo  valves  are  wired  in  a 
bridge  circuit  such  that  at  least  two  coils  must  fail  before 
the  roll/yaw  function  is  lost.  The  pitch  servo  valve  coils  are 
paralleled  for  the  same  reason.  The  colls  and  amplifiers  have 
been  designed  to  operate  at  the  higher  voltage  and  current 
requirements  of  operation  after  a  single  coil  failure.  See 
Figure  9  for  Auto  Stabilization  Servo  Valve  Wiring  Diagram. 

In  order  to  prevent  complete  loss  of  the  auto-stab  function  due  to 
failure  of  a  single  hydraulic  system,  the  four  louver  actuator 
auto -stab  servo  valves  are  paired  off  on  the  two  hydraulic  systems. 

Three  combinations  of  pairs  are  possible  and  during  normal 
system  operation  are  equally  satisfactory.  However,  considering 
single  hydraulic  system  failures,  each  combination  produces  control 
system  cross -coupling.  Two  of  these  combinations  produce  adverse 
roll/adverse  yaw  and  yaw/adverse  roll  effects.  The  adopted  com¬ 
bination  of  left  fore/right  aft  servos  on  one  hydraulic  system  and 
left  aft/right  fore  on  the  other  hydraulic  system  results  in  a  small 
amount  of  yaw/lift  or  roll/thrust  coupling.  This  coupling  is  of 
small  magnitude  and  is  expected  to  be  practically  negligible  since 
the  auto -stab  system  will  have  about  50$  of  its  normal  authority 
in  this  failure  mode. 

Connector  Mismatching  -  In  order  to  maintain  interchangeability, 
the  rate  gyro  packages  for  primary  and  secondary  auto-stab  systems 
have  the  same  connectors.  This  makes  it  possible  to  cross-connect 
either  the  power  or  signal  cables  to  the  gyro  packages.  A  cursory 
checkout  of  the  system  would  not  disclose  this  defect.  Under 
normal  flying  conditions  the  fault  could  still  go  undetected.  How¬ 
ever  should  a  malfunction  within  either  the  primary  or  secondary 
systems  cause  a  power  loss  for  that  system,  the  result  would  be 
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-{>  -  DIRECTION  OF  CURRENT  FLOW 

AR  -  AFT  RIGHT  LOUVER  ACTUATOR  VALVE  COIL 

AL  -  AFT  LEFT  LOUVER  ACTUATOR  VALVE  COIL 

FR  -  FORWARD  RIGHT  LOUVER  ACTUATOR  VALVE  COIL 

FL  -  FORWARD  LEFT  LOUVER  ACTUATOR  VALVE  COIL 

EXT  -  EXTEND 

RET  -  RETRACT 

CD-  ACTUATOR  DISPLACEMENT  DUE  TO  YAW  SIGNAL 
TWO  COILS  ARE  CONTAINED  IN  EACH  SERVO  VALVE. 


Figure  10  Auto  Stabilization  Servo  Valve  Wiring  Diagram 
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D.  2.  ♦  Auto  “Stabilization  system  (Cont'd) 

the  complete  loss  of  both  auto-stablllzatlon  systems.  In  order 
to  preserve  Independent  parallel  redundancy,  matched  pairs  of  power 
and  signal  cables  will  be  potted  together  for  a  sufficient  distance 
from  the  gyro  packages  so  that  crossconnecting  will  not  be  possible. 

*  Conversion  control  system 

The  conversion  control  system  provides  for  sequencing  and  inter¬ 
locking  the  three  Interdependent  conversion  functions.  They  are 
wing  fan  closures,  horizontal  stabilizer  (programmed)  and  diverter 
valves.  See  Figures  10  and  11  for  complete  Interlock  diagrams. 

CTOL  To  VTOL  Conversion 

Flight  simulator  studies  indicate  that  the  Ideal  sequence  of 
these  functions  is  (l)  wing  inlet  doors  start  open,  (2)  hori¬ 
zontal  stabilizer  start  "programmed"  trim,  (3)  diverter  valves 
operate.  The  horizontal  stabilizer  and  diverter  valves  are 
interlocked  to  prevent  operation  until  after  the  wing  inlet 
doors  reach  a  preset  position. 

If  the  diverter  valves  and  horizontal  stabilizer  get  out  of 
phase  with  each  other,  the  Induced  pitching  moments  are  more 
than  the  pilot  can  reasonably  control.  The  conversion flinctions 
have  been  further  interlocked  to  preclude  this  event.  The 
horizontal  stabilizer  program  starts  first  and  is  monitored 
by  the  diverter  valve  command  circuit.  If  the  horizontal 
stabilizer  does  not  start  its  programmed  motion,  the  diverter 
valves  will  not  cycle,  and  the  conversion  sequence  ends;  but  the 
aircraft  is  still  in  a  controllable  configuration. 

Assuming  normal  horizontal  stabilizer  operation,  diverter  valve 
function  is  then  monitored;  and  if  the  diverter  valves  fail  to 
operate,  the  horizontal  stabilizer  motion  is  stopped.  This 
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Figure  10  Conversion  Control  Interlocks  for  CTOL  to  VTOL  Flight  Mode 
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D.  2.  CTOL  To  VTOL  Conversion  (Cont'd) 

point  is  such  that  induced  adverse  pitching  momer«s  are  still 
controllable  by  the  pilot.  Further,  if  the  diverter  valve  "no 
function,"  signal  stopping  the  horizontal  stabilizer  is  a  fault 
(the  diverter  valve  functioned  normally  but  the  monitor  circuit 
malfunctioned.)  the  resultant  aircraft  pitching  moments  are  still 
controllable . 

VTOL  To  CTOL  Conversion 

VTOL  to  CTOL  conversion  sequence,  as  optimized  with  the  flight 
simulator,  is  accomplished  by  starting  the  diverter  valve  cycle 
simultaneously  with  the  horizontal  stabilizer  "programmed"  trim; 
and  after  a  specific  time  delay,  the  wing  inlet  doors  are  closed. 

In  order  to  provide  the  same  fail  safe  approach  to  this  conver¬ 
sion  sequence,  a  similar  automatic  functional  cross  check  is 
performed.  The  conversion  sequence  is  initiated  by  the  hori¬ 
zontal  stabilizer  "programmed"  trim.  If  the  horizontal 
stabilizer  does  not  start,  the  sequence  is  stopped.  If  the 
horizontal  stabilizer  "programmed"  trim  functions,  the  diverter 
valves  cycle  starts.  This  cycle  is  also  monitored;  and  if  the 
diverter  valve  cycle  does  not  start,  the  horizontal  stabilizer 
motion  is  stopped.  Thus  the  horizontal  stabilizer  is  never 
permitted  to  be  at  such  an  angle  of  attack  that  uncontrollable 
pitching  moments  would  be  introduced,  regardless  of  the  position 
of  the  diverter  valves. 

The  wing  inlet  doors  are  interlocked  with  the  diverter  valves 
and  cannot  be  cycled  closed  until  both  diverter  valves  have 
completed  the  cycle  to  CTOL  position. 

*  Hydraulic  simulator  plans 

The  hydraulic  simulator  will  be  used  as  a  full  scale  test  stand 
to  collect  functional  and  performance  data  for  the  aircraft 
ivotaulic  and  control  systems.  Complete  operating  histories 
will  be  recorded  for  the  entire  system  and  each  component . 
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D.  2.  *  Hydraulic  simulator  plans  (Cont'd) 

This  data  will  Include  functional,  performance,  loads,  environments, 
operating  time  or  operating  cycles,  during  installation,  checkout, 
and  simulated  flight  operations.  From  reliability  analysis  of 
this  data,  component  and  system  failure  rates  and  failure  modes  will 
be  estimated.  In  addition,  this  data  will  be  utilized  to  establish 
aircraft  operational  and  maintenance  criteria,  update  the  aircraft 
reliability  mathematical  model,  and  provide  preliminary  data  to  the 
flight  worthiness  reliability  report. 

Some  of  the  major  elements  of  the  hydraulic  simulator  are  illustrated 
in  Figures  12  through  15 . 
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Figure  13.  Loading  Bars 


Figure  14.  Loading  Cylinders 
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